Chinese Military Personnel Charged with Equifax Hacking

“This was a deliberate and sweeping intrusion into the private information of the American people,” said Attorney General William P. Barr, who made the announcement. “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information.”

en flag
nl flag
et flag
fi flag
fr flag
de flag
pt flag
ru flag
es flag

Press Announcement from United States Department of Justice

Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax

Indictment Alleges Four Members of China’s People’s Liberation Army Engaged in a Three-Month Long Campaign to Steal Sensitive Personal Information of Nearly 150 Million Americans

A federal grand jury in Atlanta returned an indictment last week charging four members of the Chinese People’s Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans’ personal data and Equifax’s valuable trade secrets.

The nine-count indictment alleges that Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可) and Liu Lei (刘磊) were members of the PLA’s 54th Research Institute, a component of the Chinese military.  They allegedly conspired with each other to hack into Equifax’s computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.

“This was a deliberate and sweeping intrusion into the private information of the American people,” said Attorney General William P. Barr, who made the announcement. “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information.”

According to the indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax’s online dispute portal.  They used this access to conduct reconnaissance of Equifax’s online dispute portal and to obtain login credentials that could be used to further navigate Equifax’s network.  The defendants spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system.  Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax’s network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.

The indictment also charges the defendants with stealing trade secret information, namely Equifax’s data compilations and database designs.  “In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military,” said Barr.

The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment.  They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.

“Today’s announcement of these indictments further highlights our commitment to imposing consequences on cyber criminals no matter who they are, where they are, or what country’s uniform they wear,” said FBI Deputy Director David Bowdich.  “The size and scope of this investigation — affecting nearly half of the U.S. population, demonstrates the importance of the FBI’s mission and our enduring partnerships with the Justice Department and the U.S. Attorney’s Office.  This is not the end of our investigation; to all who seek to disrupt the safety, security, and confidence of the global citizenry in this digitally connected world, this is a day of reckoning.”

The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud.  The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.

The investigation was conducted jointly by the U.S. Attorney’s Office for the Northern District of Georgia, the Criminal and National Security Divisions of the Department of Justice, and the FBI’s Atlanta Field Office.  The FBI’s Cyber Division also provided support.  Equifax cooperated fully and provided valuable assistance in the investigation.

Assistant U.S. Attorneys Nathan Kitchens, Samir Kaushal, and Thomas Krepp of the Northern District of Georgia; Senior Counsel Benjamin Fitzpatrick of the Criminal Division’s Computer Crime and Intellectual Property Section; and Trial Attorney Scott McCulloch of the National Security Division’s Counterintelligence and Export Control Section are prosecuting this case.  Attorneys with the Office of International Affairs provided critical assistance in obtaining evidence from overseas.

The details contained in the charging document are allegations.  The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Read the complete Department of Justice announcement at Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud

Criminal Indictment (United States of America v. Wu Zhiyong, Wang Qian, Xu Ke, Liu Lei) PDF

Wu_Zhiyong_Indictment_Final

Selected Extracts from an article by Katie Benner in the New York Times

U.S. Charges Chinese Military Officers in 2017 Equifax Hacking

The information stolen from Equifax, which is based in Atlanta, could reveal whether any American officials are under financial stress and thus susceptible to bribery or blackmail.

The indictment suggests the hack was part of a series of major data thefts organized by the People’s Liberation Army and Chinese intelligence agencies. China can use caches of personal information and combine them with artificial intelligence to better target American intelligence officers and other officials, Attorney General William P. Barr said.

The hackers’ encryption of their operations inside Equifax’s networks is a common technique and has raised new questions about why such sensitive data in American databases is not legally required to be encrypted, experts noted. Many companies have resisted such regulation, in part because encrypted data can be harder for them to search.

Read the complete article at U.S. Charges Military Officers in 2017 Equifax Hacking

Additional Reading

Source: ComplexDiscovery

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know and we will make our response to you a priority.

ComplexDiscovery is an online publication that highlights cyber, data and legal discovery insight and intelligence ranging from original research to aggregated news for use by cybersecurity, information governance, and eDiscovery professionals. The highly targeted publication seeks to increase the collective understanding of readers regarding cyber, data and legal discovery information and issues and to provide an objective resource for considering trends, technologies, and services related to electronically stored information.

ComplexDiscovery OÜ is a technology marketing firm providing strategic planning and tactical execution expertise in support of cyber, data and legal discovery organizations. Focused primarily on supporting the ComplexDiscovery publication, the company is registered as a private limited company in the European Union country of Estonia, one of the most digitally advanced countries in the world. The company operates virtually worldwide to deliver marketing consulting and services.

From Russia (and China) with Love? The UK National Cyber Security Centre Annual Review

According to the NCSC Annual Review, China remained a highly sophisticated...

New Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

According to Matt Hartman, Deputy Executive Assistant Director for Cybersecurity, "The...

A Surge in Cybercriminality? The Annual ENISA Threat Landscape Report – 9th Edition

According to EU Agency for Cybersecurity Executive Director Juhan Lepassaar, “Given...

Considering Zero Trust? November 2021 Cyber Events Report from NATO CCDCOE

Computer security professionals love to say that there is no such...

A Long Runway? KLDiscovery Files for Initial Public Offering

On Tuesday, November 23, 2021, KLDiscovery took a strong step toward...

Modus Secures Working Capital Facility from J.P. Morgan

According to Steven Horan, Chairman, and CEO of Modus, “Having the...

Driven and Innovative Discovery Merge

According to the announcement, Silver Oak Services Partners, a private equity...

Smarsh Acquires Digital Safe Product Line from Micro Focus

According to Smarsh CEO Brian Cramer, “Solving the sophisticated archiving, compliance...

An eDiscovery Market Size Mashup: 2021-2026 Worldwide Software and Services Overview

From market retraction in 2020 to resurgence in 2021, the worldwide...

A New Era in eDiscovery? Framing Market Growth Through the Lens of Six Eras

There are many excellent resources for considering chronological and historiographical approaches...

An eDiscovery Market Size Mashup: 2020-2025 Worldwide Software and Services Overview

While the Compound Annual Growth Rate (CAGR) for worldwide eDiscovery software...

Resetting the Baseline? eDiscovery Market Size Adjustments for 2020

An unanticipated pandemeconomic-driven retraction in eDiscovery spending during 2020 has resulted...

Five Great Reads on Cyber, Data, and Legal Discovery for November 2021

From worldwide eDiscovery market sizing and discovery intelligence to cybersecurity playbooks...

Five Great Reads on Cyber, Data, and Legal Discovery for October 2021

From artificial intelligence and predictive coding to eDiscovery business confidence and...

Five Great Reads on Cyber, Data, and Legal Discovery for September 2021

From countering ransomware to predictive coding and packaged services, the September...

Five Great Reads on Cyber, Data, and Legal Discovery for August 2021

From the interplay of digital forensics in eDiscovery to collecting online...

Calm Before the Storm? Eighteen Observations on eDiscovery Business Confidence in the Fall of 2021

In the fall of 2021, 71.2% of survey respondents felt that...

Help Wanted? Issues Impacting eDiscovery Business Performance: A Fall 2021 Overview

In the fall of 2021, 27.4% of respondents viewed lack of...

Harvest Time? eDiscovery Operational Metrics in the Fall of 2021

In the fall of 2021, 67 eDiscovery Business Confidence Survey participants...

Unseasonably Hot? Fall 2021 eDiscovery Business Confidence Survey Results

Since January 2016, 2,595 individual responses to twenty-four quarterly eDiscovery Business...